[mod] ci: rework workflows (#6401)

* [mod] ci: rework workflows

mod: ubuntu 26.04 runners
mod: remove podman-static
mod: longer container cache
mod: remove useless pr information
mod: sort steps
fix: use commit ref on workflow_run children
fix: missing container workflow_run check
fix: nodejs cache

* [fix] ci: apply suggestions

https://github.com/searxng/searxng/pull/6401#discussion_r3566147961
https://github.com/searxng/searxng/pull/6401#discussion_r3566147970

1 files changed, 48 insertions, 78 deletions

diff --git a/.github/workflows/container.yml b/.github/workflows/container.yml
index e0a63b1af..eedd922e5 100644
--- a/.github/workflows/container.yml
+++ b/.github/workflows/container.yml
@@ -25,25 +25,21 @@ env:
 
 jobs:
   build:
-    if: github.repository_owner == 'searxng' || github.event_name == 'workflow_dispatch'
+    if: |
+      github.event_name == 'workflow_dispatch'
+      || (github.repository_owner == 'searxng' && github.event.workflow_run.conclusion == 'success')
     name: Build (${{ matrix.arch }})
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false
       matrix:
         include:
-          - arch: amd64
-            march: amd64
-            os: ubuntu-24.04
-            emulation: false
-          - arch: arm64
-            march: arm64
-            os: ubuntu-24.04-arm
-            emulation: false
-          - arch: armv7
-            march: arm64
-            os: ubuntu-24.04-arm
-            emulation: true
+          - runner: ubuntu-26.04
+            arch: amd64
+          - runner: ubuntu-26.04-arm
+            arch: arm64
+          - runner: ubuntu-26.04-arm
+            arch: armv7
 
     permissions:
       packages: write
@@ -53,33 +49,25 @@ jobs:
       git_url: ${{ steps.build.outputs.git_url }}
 
     steps:
-      # yamllint disable rule:line-length
-      - name: Setup podman
-        env:
-          PODMAN_VERSION: "v5.7.1"
-        run: |
-          sudo apt-get purge -y podman runc crun conmon
-
-          curl -fsSLO "https://github.com/mgoltzsche/podman-static/releases/download/${{ env.PODMAN_VERSION }}/podman-linux-${{ matrix.march }}.tar.gz"
-          curl -fsSLO "https://github.com/mgoltzsche/podman-static/releases/download/${{ env.PODMAN_VERSION }}/podman-linux-${{ matrix.march }}.tar.gz.asc"
-          gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 0CCF102C4F95D89E583FF1D4F8B5AF50344BB503
-          gpg --batch --verify "podman-linux-${{ matrix.march }}.tar.gz.asc" "podman-linux-${{ matrix.march }}.tar.gz"
-
-          tar -xzf "podman-linux-${{ matrix.march }}.tar.gz"
-          sudo cp -rfv ./podman-linux-${{ matrix.march }}/etc/. /etc/
-          sudo cp -rfv ./podman-linux-${{ matrix.march }}/usr/. /usr/
-
-          sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
-      # yamllint enable rule:line-length
+      - name: Login to GHCR
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        with:
+          registry: "ghcr.io"
+          username: "${{ github.repository_owner }}"
+          password: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: Setup Python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
         with:
           python-version: "${{ env.PYTHON_VERSION }}"
 
+      - name: Setup QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
+
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
+          ref: "${{ github.event.workflow_run.head_sha || github.sha }}"
           persist-credentials: "false"
           fetch-depth: "0"
 
@@ -91,64 +79,36 @@ jobs:
             python-${{ env.PYTHON_VERSION }}-${{ runner.arch }}-
           path: "./local/"
 
-      - name: Get date
-        id: date
-        run: echo "date=$(date +'%Y%m%d')" >>$GITHUB_OUTPUT
-
       - name: Setup cache container
         uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
-          key: "container-${{ matrix.arch }}-${{ steps.date.outputs.date }}-${{ hashFiles('./requirements*.txt') }}"
+          key: "container-${{ matrix.arch }}-${{ hashFiles('./requirements*.txt') }}"
           restore-keys: |
-            container-${{ matrix.arch }}-${{ steps.date.outputs.date }}-
             container-${{ matrix.arch }}-
           path: "/var/tmp/buildah-cache-*/*"
 
-      - if: ${{ matrix.emulation }}
-        name: Setup QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
-
-      - name: Login to GHCR
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
-        with:
-          registry: "ghcr.io"
-          username: "${{ github.repository_owner }}"
-          password: "${{ secrets.GITHUB_TOKEN }}"
-
       - name: Build
         id: build
         env:
           OVERRIDE_ARCH: "${{ matrix.arch }}"
-        run: make podman.build
+        run: make container.build
 
   test:
     name: Test (${{ matrix.arch }})
-    runs-on: ${{ matrix.os }}
+    runs-on: ${{ matrix.runner }}
     needs: build
     strategy:
       fail-fast: false
       matrix:
         include:
-          - arch: amd64
-            os: ubuntu-24.04
-            emulation: false
-          - arch: arm64
-            os: ubuntu-24.04-arm
-            emulation: false
-          - arch: armv7
-            os: ubuntu-24.04-arm
-            emulation: true
+          - runner: ubuntu-26.04
+            arch: amd64
+          - runner: ubuntu-26.04-arm
+            arch: arm64
+          - runner: ubuntu-26.04-arm
+            arch: armv7
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
-        with:
-          persist-credentials: "false"
-
-      - if: ${{ matrix.emulation }}
-        name: Setup QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
-
       - name: Login to GHCR
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
@@ -156,6 +116,15 @@ jobs:
           username: "${{ github.repository_owner }}"
           password: "${{ secrets.GITHUB_TOKEN }}"
 
+      - name: Setup QEMU
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
+
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          ref: "${{ github.event.workflow_run.head_sha || github.sha }}"
+          persist-credentials: "false"
+
       - name: Test
         env:
           OVERRIDE_ARCH: "${{ matrix.arch }}"
@@ -165,7 +134,7 @@ jobs:
   release:
     if: github.repository_owner == 'searxng' && github.ref_name == 'master'
     name: Release
-    runs-on: ubuntu-24.04-arm
+    runs-on: ubuntu-26.04-arm
     needs:
       - build
       - test
@@ -174,10 +143,12 @@ jobs:
       packages: write
 
     steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+      - name: Login to Docker Hub
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
         with:
-          persist-credentials: "false"
+          registry: "docker.io"
+          username: "${{ secrets.DOCKER_USER }}"
+          password: "${{ secrets.DOCKER_TOKEN }}"
 
       - name: Login to GHCR
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
@@ -186,12 +157,11 @@ jobs:
           username: "${{ github.repository_owner }}"
           password: "${{ secrets.GITHUB_TOKEN }}"
 
-      - name: Login to Docker Hub
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+      - name: Checkout
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
         with:
-          registry: "docker.io"
-          username: "${{ secrets.DOCKER_USER }}"
-          password: "${{ secrets.DOCKER_TOKEN }}"
+          ref: "${{ github.event.workflow_run.head_sha || github.sha }}"
+          persist-credentials: "false"
 
       - name: Release
         env: